Principal Digital Forensics Analyst

Principal Digital Forensics Analyst, Warwick (Hybrid) – £65-70k plus benefits

National Gas is securing Britain’s energy.  We transport gas throughout Great Britain, repair and maintain gas pipelines, and manage the meters that allow millions of homes and businesses to access the energy they need.  We are the national gas network, providing secure energy to power Britain, achieve net zero, and maintain our industrial competitiveness.

As a Principal Digital Forensics Analyst within our Cyber Defend team, you will bring expert-level proficiency in the forensic acquisition, preservation, and analysis of digital evidence across a wide range of platforms. Your expertise will support internal investigations, e‑discovery, litigation, and incident response activities.

In this senior role, you will lead on the most complex and sensitive cases, shape and enhance our forensic methodologies, and provide guidance and mentorship to Digital Forensics Analysts and Senior Analysts within the team.

Join us, and help be the energy behind the change.

About the role

In this role, you will:

• Lead complex digital forensic investigations, determining root causes and business impacts across cyber incidents, insider threats, fraud, IP theft, and regulatory breaches, while ensuring the secure acquisition and preservation of digital evidence from diverse sources.
• Conduct advanced forensic analysis of systems, devices, memory, network activity, and malicious code to reconstruct events and support incident response, internal investigations, and legal or regulatory processes.
• Produce clear, accurate forensic reports and briefings for technical, legal, and senior stakeholders, ensuring findings are communicated effectively and appropriately.
• Enhance forensic capability by evaluating new tools and methodologies, maintaining robust SOPs, and ensuring all investigative practices remain defensible and compliant with legal and regulatory requirements.
• Support operational response and team development by collaborating closely with the CSIRT during live incidents and providing guidance and mentorship to Digital Forensics Analysts.
• Oversee eDiscovery, Legal Hold, and Subject Access Request (SAR) workflows, ensuring accurate, timely, and compliant end‑to‑end delivery. 
• Be able to work on a hybrid basis at our Warwick HQ, as well as other national sites, as and when required for incident response.

Experience required

• Significant experience in OT environments with strong knowledge of OT security frameworks (IEC 62443, NCSC CAF, NIST CSF, MITRE ATT&CK for ICS).
• Expert understanding of digital forensic principles, evidence handling, and legal/regulatory obligations (ACPO, GDPR).
• Proficiency with leading forensic tools, OS internals (Windows, macOS, Linux), file systems, and core network protocols.
• Strong background in network forensics, log analysis, and handling complex investigations involving encrypted or corrupted data.
• Excellent written and verbal communication skills for technical and senior audiences.
• High attention to detail and rigorous documentation standards.
• Proven ability to manage workloads independently and work with legal teams, law enforcement, and senior leadership.
• Practical experience in malware analysis (static/dynamic), malicious document analysis, and eDiscovery, Legal Hold, and SAR processes.
• Compliance with organisational policies and procedures.
• Evidence at least two relevant certifications, such as GCFE, GCFA, GCIH, GNFA, GICSP, GRID, GREM, or CISSP.

What we can offer you

• Salary between £65,000 to £70,000 (dependent on experience)
• Annual bonus of 6% based on personal and company performance
• 26 days’ holiday plus 8 statutory holidays – plus option to buy 5 additional days
• Double-match pension scheme - for every £1 you put in, we'll add £2 (max company contribution 12%)
• Opt-In flexible benefit scheme, including salary sacrifice private healthcare, dental insurance, technology plans and more
• Financial protection with 10x salary death in service and financial support if you're unable to work due to long term illness or injury
• Excellent family friendly provisions - maternity/paternity/adoption/surrogacy/ shared parental leave
• Career progression, professional training and development
• Employee assistance programme offering free confidential professional counselling 24/7
• Financial support to cover the cost of professional membership subscriptions, and study support to complete accountancy qualifications

Other 'nice to knows':

• Hybrid working
• Career progression and ongoing professional training and development
• Free gym and exercise classes onsite at our Warwick office, sports clubs to join
• Subsidised canteen and coffee shop
• Free parking

More Information

National Gas is securing Britain’s energy.  Gas is an essential part of a secure energy supply in Britain, and will continue to play a vital role for decades to come.  More than ever, we need the security that gas brings to keep the lights on, businesses running, and to protect jobs. National Gas provides that security.

We are responsible for transporting gas to power stations, major industries, storage facilities, more than 500,000 businesses, and 23 million homes through nearly 5,000 miles of pipes across Britain.

National Gas is also proud to lead the way in transforming the energy network for a net zero future. Gas provides the energy security to support renewable electricity generation, and we are developing our infrastructure to transport hydrogen and carbon dioxide across the country. 

We are committed to building a workforce that represents the communities we serve.  We celebrate the different experiences our colleagues bring to our organisation, and strongly encourage applicants of all backgrounds to apply.

Security Clearance

The successful candidate must be able to achieve and maintain Security Check (SC) security clearance for this role.

Many of the positions within our company are subject to national security clearance and Trade Control restrictions. This means that your eligibility for certain roles may be affected by your place of birth, nationality, current or former citizenship, and any residency you hold or have held. Further details are available at United Kingdom Security Vetting: clearance levels - GOV.UK (www.gov.uk).

#LI-HYBRID #LI-KK1